CVE-2026-103262

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service (DoS) when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly compressed payload (a decompression bomb) that expands to an enormous size. This unbounded memory consumption exhausts system resources and crashes the application.

This vulnerability has been rated as Important because an untrusted remote server can remotely terminate an application process through memory exhaustion without requiring credentials. By default, Tornado deploys the SimpleAsyncHTTPClient implementation, which includes built-in thresholds for decompressed and raw payload sizes and remains unaffected by this flaw. However, systems that explicitly configure CurlAsyncHTTPClient—typically enabled for custom proxy routing or advanced transport options—bypass these protections and do not enforce body size constraints. When such client applications fetch resources from compromised or malicious web endpoints, the resulting decompression bomb can consume all available system memory, leading to an immediate denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.

1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.
2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.
3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.

Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.